Hi there, I need help as I am unable to update a few updates for my Windows 7 Home Premium 64 Bit. But 1st I would like to try solving this update KB2732487 with the error code 800700B7.
I have attached the CBS log for your reference, I hope someone could assist me with the enquiries, thank you.
Windows Update Error 800700B7 - Microsoft Community
Try the above. It may help.
Please downloadand save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need tolook in the details for Windows 7, downloading from the Microsoft DownloadCenter)
Run it - The toolcan take anywhere from 5 mins to a couple of hours to run (or 'Install')depending on how much it has to do, and may exit silently - it may appear tofreeze for most of that time, but be patient.
The result islogged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file
Then zip theCheckSUR.log and attach it to your reply
Hi Gary, I tried that and it didn't work.
Hi Noel, I have attached the file as for your reference.
Thanks guys!
Interesting CheckSUR!
We'll have to work on the Event Log first - it's going to cause problems otherwise.Code:Unavailable repair files: servicing\packages\Package_2_for_KB2761451~31bf3856ad364e35~amd64~~9.4.1.0.mum servicing\packages\Package_2_for_KB2761451~31bf3856ad364e35~amd64~~9.4.1.0.cat (w) Unable to open Event Log 0x000006BA Application OpenEventLog failed: 0x000006BA - The RPC server is unavailable. . (w) Unable to open Event Log 0x000006BA System OpenEventLog failed: 0x000006BA - The RPC server is unavailable.
Please open an Elevated Command Prompt, and run the following command...
REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
post the results
Here are some instructions to make lifeeasier :)
1) To open anElevated Command Prompt Window (the ECP window), click on Start, All Programs,Accessories – then right-click on Command Prompt, and select Run asAdministrator. Accept the UAC prompt.
2) To run thecommands easier, highlight the block of commands, and right-click on thehighlight – select Copy. In the CP Window, click on the black/white icon at topleft – select Paste. The commands will run but may not complete the lastcommand, so hit the Enter Key once.
3) To copy theresults... click on the Black/White icon in the top left, and select Edit...'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to pasteit into your response.
Here you go :) Thanks for helping!
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\windows\system32>REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\
CurrentVersion\Winlogon"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
ReportBootOk REG_SZ 1
Shell REG_SZ explorer.exe
PreCreateKnownFolders REG_SZ {A520A1A4-1780-4FF6-BD18-167343C5AF16}
Userinit REG_SZ C:\Windows\system32\userinit.exe,
VMApplet REG_SZ SystemPropertiesPerformance.exe /pagefile
AutoRestartShell REG_DWORD 0x1
Background REG_SZ 0 0 0
CachedLogonsCount REG_SZ 10
DebugServerCommand REG_SZ no
ForceUnlockLogon REG_DWORD 0x0
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PasswordExpiryWarning REG_DWORD 0x5
PowerdownAfterShutdown REG_SZ 0
ShutdownWithoutLogon REG_SZ 0
WinStationsDisabled REG_SZ 0
DisableCAD REG_DWORD 0x1
scremoveoption REG_SZ 0
ShutdownFlags REG_DWORD 0x7
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExten
sions
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLog
onChecked
C:\windows\system32>
That knocks out the easy fix
The error message is in fact a little misleading - if the RPC server truly wasn't available, Windows wouldn't boot.
The real problem is that for some reason, the Event monitoring services are unable to communicate with it.
Let's check the services involved.
Please open an Elevated Command Prompt, and run the following commands - post the results.
SC QUERYEX EVENTLOG
SC QUERYEX EVENTSYSTEM
SC QUERYEX WECSVC
SC QUERYEX WERSVC
SC QC BITS
SC QC BFE
REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\eventlog
Here is the results:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\windows\system32>SC QUERYEX EVENTLOG
SERVICE_NAME: EVENTLOG
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 1352
FLAGS :
C:\windows\system32> SC QUERYEX EVENTSYSTEM
SERVICE_NAME: EVENTSYSTEM
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 1680
FLAGS :
C:\windows\system32> SC QUERYEX WECSVC
SERVICE_NAME: WECSVC
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :
C:\windows\system32> SC QUERYEX WERSVC
SERVICE_NAME: WERSVC
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :
C:\windows\system32> SC QC BITS
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: BITS
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START (DELAYED)
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\windows\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Background Intelligent Transfer Service
DEPENDENCIES : RpcSs
: EventSystem
SERVICE_START_NAME : LocalSystem
C:\windows\system32> SC QC BFE
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: BFE
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\windows\system32\svchost.exe -k LocalServiceNoNe
twork
LOAD_ORDER_GROUP : NetworkProvider
TAG : 0
DISPLAY_NAME : Base Filtering Engine
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT AUTHORITY\LocalService
C:\windows\system32> REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\eventlog
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog
ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\wevtsvc.dll
ServiceMain REG_SZ ServiceMain
PlugPlayServiceType REG_DWORD 0x3
ServiceDllUnloadOnStop REG_DWORD 0x1
DisplayName REG_SZ @%SystemRoot%\system32\wevtsvc.dll,-200
Group REG_SZ Event Log
ImagePath REG_EXPAND_SZ %SystemRoot%\System32\svchost.exe -k LocalServ
iceNetworkRestricted
Description REG_SZ @%SystemRoot%\system32\wevtsvc.dll,-201
ObjectName REG_SZ NT AUTHORITY\LocalService
ErrorControl REG_DWORD 0x1
Start REG_DWORD 0x2
Type REG_DWORD 0x20
ServiceSidType REG_DWORD 0x1
RequiredPrivileges REG_MULTI_SZ SeChangeNotifyPrivilege\0SeImpersonate
Privilege
FailureActionsOnNonCrashFailures REG_DWORD 0x1
FailureActions REG_BINARY 80510100000000000000000003000000140000000100
000060EA000001000000C0D401000000000000000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Application
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\HardwareEvents
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Internet Explorer
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Key Management Ser
vice
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Media Center
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\OAlerts
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\System
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Windows PowerShell
C:\windows\system32>
C:\windows\system32>
Those are all normal, so far as I can see.
Let's see what renaming the two log files does.
Please open an Elevated Command Prompt, and run the following commands.
SC QUERYEX SCHEDULE
REN C:\Windows\System32\winevt\logs\Application.evtx App.old
REN C:\Windows\System32\winevt\logs\System.evtx Sys.old
You may well get errors from the last two if the Scheduler task is running properly.
Post the results, and then try again from Safe Mode
Quote